resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/resolver/iterative.go

@@ -204,6 +204,12 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 	return ips
 }
 
+// followDelegation follows referrals from servers, the root servers, to
+// domain and returns the NS set of domain's delegation. When the servers
+// of the zone domain is in answer that domain does not exist, the error
+// is ErrNXDomain. When they answer that it has no delegation of its own,
+// because it is not the zone's apex, the set is empty and there is no
+// error. Any other error means that no such answer came.
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
@@ -234,10 +240,15 @@ func (r *Resolver) followDelegation(
 		// An authoritative reply comes from the servers of the zone
 		// domain is in; it is not a referral, even when its authority
 		// section lists that zone's NS records. Without NS records in
-		// the answer, domain is not the zone's apex and has no
-		// nameservers of its own.
+		// the answer, domain has no nameservers of its own: it does
+		// not exist, when the reply is NXDOMAIN, or else it is not the
+		// zone's apex.
+		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
+			return nil, ErrNXDomain
+		}
+
 		if resp.Authoritative {
-			return nil, ErrNoNameservers
+			return []string{}, nil
 		}
 
 		authNS := extractNSSet(resp.Ns)
@@ -486,7 +497,8 @@ func (r *Resolver) resolveNSIPs(
 
 // resolveNSIterative queries for NS records using iterative
 // resolution as a fallback when followDelegation finds no
-// authoritative answer in the delegation chain.
+// authoritative answer in the delegation chain. Its result means what
+// followDelegation's does.
 func (r *Resolver) resolveNSIterative(
 	ctx context.Context,
 	domain string,
@@ -516,6 +528,16 @@ func (r *Resolver) resolveNSIterative(
 			return nsNames, nil
 		}
 
+		// As in followDelegation: domain has no nameservers of its
+		// own.
+		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
+			return nil, ErrNXDomain
+		}
+
+		if resp.Authoritative {
+			return []string{}, nil
+		}
+
 		// Follow delegation.
 		authNS := extractNSSet(resp.Ns)
 		if len(authNS) == 0 {
@@ -601,12 +623,23 @@ func (r *Resolver) resolveARecord(
 // FindAuthoritativeNameservers traces the delegation chain from
 // root servers to discover all authoritative nameservers for the
 // given domain, as the delegation from its parent zone's servers lists
-// them. For a name that is not a zone apex it tries each
-// parent name in turn, so it returns the nameservers of the zone the
-// name is in.
+// them. When the servers asked answer that the name has no delegation
+// of its own, or does not exist, it tries each parent name in turn, so
+// it returns the nameservers of the zone the name is in. When they do
+// not answer, it returns the error and tries no parent name.
 func (r *Resolver) FindAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
+) ([]string, error) {
+	return r.findAuthoritativeNameservers(ctx, domain, rootServerList())
+}
+
+// findAuthoritativeNameservers is FindAuthoritativeNameservers with each
+// walk starting at servers, the root servers.
+func (r *Resolver) findAuthoritativeNameservers(
+	ctx context.Context,
+	domain string,
+	servers []string,
 ) ([]string, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -622,19 +655,16 @@ func (r *Resolver) FindAuthoritativeNameservers(
 
 		candidate := strings.Join(labels[i:], ".") + "."
 
-		nsNames, err := r.followDelegation(
-			ctx, candidate, rootServerList(),
-		)
-		if err == nil && len(nsNames) > 0 {
+		nsNames, err := r.followDelegation(ctx, candidate, servers)
+		if err != nil && !errors.Is(err, ErrNXDomain) {
+			return nil, err
+		}
+
+		if len(nsNames) > 0 {
 			sort.Strings(nsNames)
 
 			return nsNames, nil
 		}
-
-		// The root servers would refuse every parent name too.
-		if errors.Is(err, ErrIntercepted) {
-			return nil, err
-		}
 	}
 
 	return nil, ErrNoNameservers
@@ -852,9 +882,7 @@ func readReply(
 	// A reply with no answer that lists other nameservers, from a server
 	// that does not hold the name's zone, is a referral and says nothing
 	// about the name's records. A server named in the delegation that
-	// does not hold the zone may send one, as do a parent zone's servers
-	// when FindAuthoritativeNameservers found no delegation for the
-	// name's zone and moved on to a parent name.
+	// does not hold the zone may send one.
 	if !msg.Authoritative && len(msg.Answer) == 0 &&
 		len(extractNSSet(msg.Ns)) > 0 {
 		state.gotReferral = true
@@ -1022,12 +1050,22 @@ func (r *Resolver) queryEachNS(
 	return results, nil
 }
 
-// LookupNS returns the NS record set for a domain.
+// LookupNS returns the NS record set of a domain, as the delegation from
+// its parent zone's servers lists it, and never a parent name's. When
+// they answer that the domain does not exist, the error is ErrNXDomain.
+// When they answer that it has no delegation of its own, the set is
+// empty and there is no error.
 func (r *Resolver) LookupNS(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
-	return r.FindAuthoritativeNameservers(ctx, domain)
+	if checkCtx(ctx) != nil {
+		return nil, ErrContextCanceled
+	}
+
+	return r.followDelegation(
+		ctx, dns.Fqdn(strings.ToLower(domain)), rootServerList(),
+	)
 }
 
 // LookupAllRecords performs iterative resolution to find all DNS